#!/bin/sh

# Little script to block IP addresses doing ssh brute force dictionary attacks
# Launch from /etc/rc.local: /usr/local/sbin/ssh-ids.sh </dev/null >/dev/null 2>&1 &

LOGGER=/usr/bin/logger
IPTABLES=/sbin/iptables
TAIL=/usr/bin/tail
EGREP=/bin/egrep
AWK=/usr/bin/awk

# Do not block these (space separated):
NOBLOCK='127.0.0.1'

drop()
{
        for ipaddr in $NOBLOCK; do
                if [ "$ipaddr" = "$1" ]; then
                        return
                fi
        done
        $LOGGER -i -t ssh-ids.sh -p auth.notice "Dropping $1"
        $IPTABLES -D INPUT -s $1 -j DROP >/dev/null 2>&1
        $IPTABLES -A INPUT -s $1 -j DROP >/dev/null 2>&1
}

# Since awk(1) can't use line-buffering we have to invoke it for each entry
$TAIL -F /var/log/auth.log | $EGREP --line-buffered 'Invalid\ user|Did\ not\ receive\ identification\ string\ from' | (
        while read l; do
                drop $(echo "$l" | $AWK '{print $NF}')
        done
)